registry / @maxiaochao/pi-toolkit / 0.9.2

@maxiaochao/pi-toolkit@0.9.2

Personal pi coding agent toolkit: /todos, /btw, /cache_export and apply_patch extensions, browser automation, and bundled theme/skills.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The source confirms automatic postinstall setup of package-owned agent guidance, which merits a warning under the agent integration policy. The inspected behavior does not support a malicious verdict or publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package with npm triggers its postinstall script.

Impact

The installed guidance can influence later coding-agent sessions; the inspected code does not establish a foreign or broad agent control-surface takeover.

Mechanism

The script copies the bundled AGENTS.md into ~/.pi/agent/AGENTS.md when the file is missing or differs, and initializes a default theme setting when needed.

AI rationale

Evidence

package.jsonscripts/install-agents.mjsglobal/AGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package runs scripts/install-agents.mjs during postinstall.
That installer copies bundled guidance to the current user's .pi/agent/AGENTS.md when it is absent or differs.
The bundled file describes itself as behavioral guidance for coding agents, making this a first-party agent setup with an automatic install trigger.

Evidence against

The installer writes only the package's bundled guidance to that agent file and initializes a missing theme setting; inspected code showed no foreign agent configuration target.
The flagged browser test is explicitly an end-to-end test, and the browser automation files inspect or control Chrome through its DevTools interface.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

Source & flagged code

10 flagged

package.jsonView file

Lines 35-61json

35 "./themes"

36 ]

37 },

38 "bin": {

39 "pi-worktree": "bin/pi-worktree"

40 },

41 "peerDependencies": {

42 "@earendil-works/pi-ai": "*",

43 "@earendil-works/pi-coding-agent": "*",

44 "@earendil-works/pi-tui": "*",

45 "typebox": "*"

46 },

47 "dependencies": {

48 "ws": "^8.19.0"

49 },

50 "scripts": {

51 "test": "cd extensions/cache-export && node --experimental-strip-types tests/run-tests.mjs && node --experimental-strip-types ../tests/btw-history.mjs && node --experimental-strip-types ../tests/todo-state.mjs && node tests/e2e-browser.mjs && cd ../codex-edit && node --experimental-strip-types --test tests/package.test.mjs tests/parser.test.mjs",

52 "load-test": "pi -ne -e ./extensions/todo.ts && pi -ne -e ./extensions/cache-export/index.ts && pi -ne -e ./extensions/btw.ts && pi -ne -e ./extensions/codex-edit/index.ts",

53 "eval:agents": "node evaluations/agents-md/run.mjs",

54 "eval:agents:test": "node evaluations/agents-md/tests/run-tests.mjs",

55 "postinstall": "node scripts/install-agents.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L55

56 },

57 "publishConfig": {

58 "access": "public"

59 }

60}

extensions/cache-export/tests/e2e-browser.mjsView file

Lines 1-32javascript

1// Real-browser end-to-end test for the cache dashboard.

2// Drives actual pointer events in headless Chromium via raw CDP (Node 22

3// built-ins only: fetch + WebSocket) and asserts the hover tooltip keeps

4// working across polyline break boundaries and inside segment views.

5//

6// Chrome discovery mirrors the web-browser skill (BROWSER_BIN, common Linux

7// paths, Playwright cache, WSL Windows Chrome). If no browser is found the

8// test prints SKIP and exits 0 so CI without Chrome still passes; if a

9// browser IS found, failing assertions exit 1.

skills/web-browser/scripts/start.jsView file

Lines 41-81javascript

42const HOME = process.env["HOME"] || homedir();

43const CACHE_ROOT = join(HOME, ".cache", "agent-web"

skills/chrome-cdp/scripts/cdp.mjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// cdp - lightweight Chrome DevTools Protocol CLI

3// Uses raw CDP over WebSocket, no Puppeteer dependency.

4// Requires Node 22+ (built-in WebSocket).

5//

6// Per-tab persistent daemon: page commands go through a daemon that holds

7// the CDP session open. Chrome's "Allow debugging" modal fires once per

8// daemon (= once per tab). Daemons auto-exit after 20min idle.

10import { readFileSync, writeFileSync, unlinkSync, existsSync, mkdirSync }

scripts/install-agents.mjsView file

Lines 1-21javascript

1// postinstall hook: sync the bundled global AGENTS.md and seed the default theme

2// without overriding a theme the user has already selected.

3import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync, chmodSync } from "node:fs";

4import { homedir, platform } from "node:os";

5import { dirname, join } from "node:path";

skills/pdlog/tools/ppmdView file

•path = skills/pdlog/tools/ppmd kind = native_binary sizeBytes = 68456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

skills/pdlog/tools/ppmdView on unpkg

bin/pi-worktree-completion.bashView file

•path = bin/pi-worktree-completion.bash kind = build_helper sizeBytes = 1368 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/pi-worktree-completion.bashView on unpkg

bin/pi-worktreeView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/pi-worktreeView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agents.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

extensions/cache-export/tests/e2e-browser.mjsView file

12L13: import { spawn, execFileSync } from "node:child_process"; L14: import { existsSync, mkdtempSync, readdirSync, rmSync } from "node:fs";

High

Child Process

Package source references child process execution.

extensions/cache-export/tests/e2e-browser.mjsView on unpkg · L12

•matchType = normalized_sha256 matchedPackage = @maxiaochao/pi-toolkit@0.5.2 matchedPath = extensions/cache-export/tests/e2e-browser.mjs matchedIdentity = npm:QG1heGlhb2NoYW8vcGktdG9vbGtpdA:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

1 Critical7 High5 Medium5 Low

CriticalAi Agent Control Hijackscripts/install-agents.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processextensions/cache-export/tests/e2e-browser.mjs

HighShellskills/web-browser/scripts/start.js

HighSame File Env Network Executionskills/chrome-cdp/scripts/cdp.mjs

HighSemantic Analysis Limitedbin/pi-worktree

HighKnown Malware Source Similarityskills/chrome-cdp/scripts/cdp.mjs

HighKnown Malware Source Similarityextensions/cache-export/tests/e2e-browser.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryskills/pdlog/tools/ppmd

Medium

Affected versions and remediation

This report applies to @maxiaochao/pi-toolkit@0.9.2.

See all versions of @maxiaochao/pi-toolkit for other recorded verdicts.

Review the evidence and your use of @maxiaochao/pi-toolkit@0.9.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-11 18:11:22.371Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.